Home / Knowledge hub / API gateway
Knowledge hub
API gateway
A front door that routes API traffic and applies shared checks like auth and limits.
What it means
An API gateway is a single entry point placed in front of your services. Requests from apps and partners arrive there first, and it routes each one to the right service behind it. Along the way it can apply shared rules such as authentication, rate limits, logging and request size limits.
The appeal is consistency. Instead of every team writing its own checks, the common ones live in one place. The limit is that a gateway sees requests, not meaning. It does not know whether this customer may read that invoice.
Why it matters
A gateway is a good place to enforce rate limiting, to reject calls without a valid token, and to keep a single record of who called what. Done well it shrinks the number of places a mistake can hide, and it gives you one point to switch off a misbehaving client.
The risk is leaning on it too much. Teams assume the gateway has checked everything, so the services behind it skip their own authorisation. A request that reaches a service directly, or a path the gateway does not cover, then meets no check at all.
How it shows up
You meet gateways as managed cloud services, as open-source proxies and as part of a service mesh. Typical weaknesses are routes that were never put behind the gateway, old versions left reachable, rules that differ between environments, and services that trust any request that appears to come from inside.
Check three things. Can the services be reached without going through the gateway? Does each service still decide what the caller may do? Do the gateway's limits and logs cover every route in your API inventory, including the forgotten ones?
Questions people ask
API gateway, answered
Is an API gateway the same as a WAF?
No. A gateway routes and manages API traffic and applies shared policies. A web application firewall inspects requests for known attack patterns.
Some products offer both, but they solve different problems, and neither replaces checks inside the application.
Does an API gateway handle authorisation?
It can check that a caller is signed in and holds the right scope or role. It rarely knows whether a given account owns a given record.
That object-level decision still belongs in the service that holds the data.
Can attackers bypass the gateway?
Yes, if a service is reachable some other way, such as a public address, a forgotten route or an internal network the attacker has reached.
Lock services so they accept traffic only from the gateway, and test that this is true.
Do we need a gateway for a small product?
Not always. A single application with sound middleware may be enough.
A gateway pays off when you have several services, outside partners, or a need for one place to manage limits and keys.
What should we test behind a gateway?
Test the services directly, test routes missing from the gateway's configuration, and test cross-account access on every endpoint.
A pass at the gateway tells you little about the service behind it.
Related
Terms that sit next to this one
API
The part of your application other software talks to, not a person.
Rate limiting
Capping how often something can be attempted, per user or per address.
API authentication
How an API decides which caller is making a request before it does anything.
API inventory
A maintained list of every API you expose, who owns it and what it returns.
Shadow API
An API running in production that nobody has documented, tracked or secured.
What sits behind the front door?
A gateway checks the front. We test the services behind it, the routes it never covered and what each signed-in account can reach that it should not, with proof. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.